introduce new pattern of GH PAT usage for #2641 (#22177)

Author: Mykyta-Serbynevskyi

.github/workflows/approve-and-merge-dispatch.yml

@@ -6,20 +6,11 @@ jobs:
   approveAndMergeDispatch:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout Airbyte
-        uses: actions/checkout@v3
-      - name: Check PAT rate limits
-        run: |
-          ./tools/bin/find_non_rate_limited_PAT \
-            ${{ secrets.AIRBYTEIO_PAT }} \
-            ${{ secrets.OCTAVIA_GITHUB_RUNNER_TOKEN }} \
-            ${{ secrets.SUPERTOPHER_PAT }}
-
       - name: Auto Approve Slash Command Dispatch
         uses: peter-evans/slash-command-dispatch@v3
         id: scd
         with:
-          token: ${{ env.PAT }}
+          token: ${{ secrets.GH_PAT_APPROVINGTON_OCTAVIA }}
           permission: write
           issue-type: pull-request
           repository: airbytehq/airbyte-cloud

.github/workflows/commands-for-testing-tool.yml

@@ -13,15 +13,6 @@ jobs:
       comment-id: ${{ steps.comment-info.outputs.comment-id }}
       command: ${{ steps.regex.outputs.first_match }}
     steps:
-      - name: Checkout Airbyte
-        uses: actions/checkout@v3
-      - name: Check PAT rate limits
-        run: |
-          ./tools/bin/find_non_rate_limited_PAT \
-            ${{ secrets.AIRBYTEIO_PAT }} \
-            ${{ secrets.OSS_BUILD_RUNNER_GITHUB_PAT }} \
-            ${{ secrets.SUPERTOPHER_PAT }} \
-            ${{ secrets.DAVINCHIA_PAT }}
       - name: Get PR repo and ref
         id: getref
         run: |

.github/workflows/connector_integration_tests.yml

@@ -28,7 +28,7 @@ jobs:
       - name: Launch Integration Tests
         run: python ./tools/bin/ci_integration_workflow_launcher.py base-normalization source-acceptance-test source:beta source:GA destination:beta destination:GA
         env:
-          GITHUB_TOKEN: ${{ secrets.SLASH_COMMAND_PAT }}
+          GITHUB_TOKEN: ${{ secrets.GH_PAT_MAINTENANCE_OSS }}
   launch_integration_tests_alpha_only:
     runs-on: ubuntu-latest
     if: github.ref == 'refs/heads/master'
@@ -47,4 +47,4 @@ jobs:
       - name: Launch Integration Tests (Alpha connectors)
         run: python ./tools/bin/ci_integration_workflow_launcher.py source:alpha destination:alpha
         env:
-          GITHUB_TOKEN: ${{ secrets.SLASH_COMMAND_PAT }}
+          GITHUB_TOKEN: ${{ secrets.GH_PAT_MAINTENANCE_OSS }}

.github/workflows/deploy-oss-catalog.yml

@@ -36,14 +36,9 @@ jobs:
           gcs_bucket_name="prod-airbyte-cloud-connector-metadata-service"
           catalog_path="airbyte-config/init/src/main/resources/seed/oss_catalog.json"
           gsutil -h "Cache-Control:public, max-age=10" cp "$catalog_path" "gs://$gcs_bucket_name/oss_catalog.json"
-      - name: Check PAT rate limits
-        run: |
-          ./tools/bin/find_non_rate_limited_PAT \
-            ${{ secrets.OCTAVIA_4_ROOT_ACCESS }} \
-            ${{ secrets.OCTAVIA_PAT }}
       - name: Trigger Cloud catalog generation
         uses: peter-evans/repository-dispatch@v2
         with:
-          token: ${{ env.PAT }}
+          token: ${{ secrets.GH_PAT_MAINTENANCE_OCTAVIA }}
           repository: airbytehq/airbyte-cloud
           event-type: generate-cloud-catalog

.github/workflows/gke-kube-test-command.yml

@@ -33,10 +33,8 @@ jobs:
       - name: Check PAT rate limits
         run: |
           ./tools/bin/find_non_rate_limited_PAT \
-            ${{ secrets.AIRBYTEIO_PAT }} \
-            ${{ secrets.OSS_BUILD_RUNNER_GITHUB_PAT }} \
-            ${{ secrets.SUPERTOPHER_PAT }} \
-            ${{ secrets.DAVINCHIA_PAT }}
+            ${{ secrets.GH_PAT_BUILD_RUNNER_OSS }} \
+            ${{ secrets.GH_PAT_BUILD_RUNNER_BACKUP }}
       - name: Start AWS Runner
         id: start-ec2-runner
         uses: ./.github/actions/start-aws-runner
@@ -152,10 +150,8 @@ jobs:
       - name: Check PAT rate limits
         run: |
           ./tools/bin/find_non_rate_limited_PAT \
-            ${{ secrets.AIRBYTEIO_PAT }} \
-            ${{ secrets.OSS_BUILD_RUNNER_GITHUB_PAT }} \
-            ${{ secrets.SUPERTOPHER_PAT }} \
-            ${{ secrets.DAVINCHIA_PAT }}
+            ${{ secrets.GH_PAT_BUILD_RUNNER_OSS }} \
+            ${{ secrets.GH_PAT_BUILD_RUNNER_BACKUP }}
       - name: Stop EC2 runner
         uses: supertopher/[email protected]
         with:

.github/workflows/gradle.yml

@@ -124,7 +124,6 @@ jobs:
       - uses: actions/setup-python@v4
         with:
           python-version: "3.9"
-          token: ${{ env.PAT }}
 
       - name: Set up CI Gradle Properties
         run: |
@@ -191,10 +190,8 @@ jobs:
       - name: Check PAT rate limits
         run: |
           ./tools/bin/find_non_rate_limited_PAT \
-            ${{ secrets.AIRBYTEIO_PAT }} \
-            ${{ secrets.OSS_BUILD_RUNNER_GITHUB_PAT }} \
-            ${{ secrets.SUPERTOPHER_PAT }} \
-            ${{ secrets.DAVINCHIA_PAT }}
+            ${{ secrets.GH_PAT_BUILD_RUNNER_OSS }} \
+            ${{ secrets.GH_PAT_BUILD_RUNNER_BACKUP }}
       - name: Start AWS Runner
         id: start-ec2-runner
         uses: ./.github/actions/start-aws-runner
@@ -230,7 +227,6 @@ jobs:
       - uses: actions/setup-python@v4
         with:
           python-version: "3.9"
-          token: ${{ env.PAT }}
 
       - name: Install Pyenv
         run: python3 -m pip install virtualenv==16.7.9 --user
@@ -345,10 +341,8 @@ jobs:
       - name: Check PAT rate limits
         run: |
           ./tools/bin/find_non_rate_limited_PAT \
-            ${{ secrets.AIRBYTEIO_PAT }} \
-            ${{ secrets.OSS_BUILD_RUNNER_GITHUB_PAT }} \
-            ${{ secrets.SUPERTOPHER_PAT }} \
-            ${{ secrets.DAVINCHIA_PAT }}
+            ${{ secrets.GH_PAT_BUILD_RUNNER_OSS }} \
+            ${{ secrets.GH_PAT_BUILD_RUNNER_BACKUP }}
       - name: Stop EC2 runner
         uses: supertopher/[email protected]
         with:
@@ -378,10 +372,8 @@ jobs:
       - name: Check PAT rate limits
         run: |
           ./tools/bin/find_non_rate_limited_PAT \
-            ${{ secrets.AIRBYTEIO_PAT }} \
-            ${{ secrets.OSS_BUILD_RUNNER_GITHUB_PAT }} \
-            ${{ secrets.SUPERTOPHER_PAT }} \
-            ${{ secrets.DAVINCHIA_PAT }}
+            ${{ secrets.GH_PAT_BUILD_RUNNER_OSS }} \
+            ${{ secrets.GH_PAT_BUILD_RUNNER_BACKUP }}
       - name: Start AWS Runner
         id: start-ec2-runner
         uses: ./.github/actions/start-aws-runner
@@ -416,7 +408,6 @@ jobs:
       - uses: actions/setup-python@v4
         with:
           python-version: "3.9"
-          token: ${{ env.PAT }}
 
       - name: Set up CI Gradle Properties
         run: |
@@ -471,10 +462,8 @@ jobs:
       - name: Check PAT rate limits
         run: |
           ./tools/bin/find_non_rate_limited_PAT \
-            ${{ secrets.AIRBYTEIO_PAT }} \
-            ${{ secrets.OSS_BUILD_RUNNER_GITHUB_PAT }} \
-            ${{ secrets.SUPERTOPHER_PAT }} \
-            ${{ secrets.DAVINCHIA_PAT }}
+            ${{ secrets.GH_PAT_BUILD_RUNNER_OSS }} \
+            ${{ secrets.GH_PAT_BUILD_RUNNER_BACKUP }}
       - name: Stop EC2 runner
         uses: supertopher/[email protected]
         with:
@@ -504,10 +493,8 @@ jobs:
       - name: Check PAT rate limits
         run: |
           ./tools/bin/find_non_rate_limited_PAT \
-            ${{ secrets.AIRBYTEIO_PAT }} \
-            ${{ secrets.OSS_BUILD_RUNNER_GITHUB_PAT }} \
-            ${{ secrets.SUPERTOPHER_PAT }} \
-            ${{ secrets.DAVINCHIA_PAT }}
+            ${{ secrets.GH_PAT_BUILD_RUNNER_OSS }} \
+            ${{ secrets.GH_PAT_BUILD_RUNNER_BACKUP }}
       - name: Start AWS Runner
         id: start-ec2-runner
         uses: ./.github/actions/start-aws-runner
@@ -540,7 +527,6 @@ jobs:
       - uses: actions/setup-python@v4
         with:
           python-version: "3.9"
-          token: ${{ env.PAT }}
 
       - name: Delete default old docker and replace it with a new one
         shell: bash
@@ -600,10 +586,8 @@ jobs:
       - name: Check PAT rate limits
         run: |
           ./tools/bin/find_non_rate_limited_PAT \
-            ${{ secrets.AIRBYTEIO_PAT }} \
-            ${{ secrets.OSS_BUILD_RUNNER_GITHUB_PAT }} \
-            ${{ secrets.SUPERTOPHER_PAT }} \
-            ${{ secrets.DAVINCHIA_PAT }}
+            ${{ secrets.GH_PAT_BUILD_RUNNER_OSS }} \
+            ${{ secrets.GH_PAT_BUILD_RUNNER_BACKUP }}
       - name: Stop EC2 runner
         uses: supertopher/[email protected]
         with:
@@ -633,10 +617,8 @@ jobs:
       - name: Check PAT rate limits
         run: |
           ./tools/bin/find_non_rate_limited_PAT \
-            ${{ secrets.AIRBYTEIO_PAT }} \
-            ${{ secrets.OSS_BUILD_RUNNER_GITHUB_PAT }} \
-            ${{ secrets.SUPERTOPHER_PAT }} \
-            ${{ secrets.DAVINCHIA_PAT }}
+            ${{ secrets.GH_PAT_BUILD_RUNNER_OSS }} \
+            ${{ secrets.GH_PAT_BUILD_RUNNER_BACKUP }}
       - name: Start AWS Runner
         id: start-ec2-runner
         uses: ./.github/actions/start-aws-runner
@@ -668,7 +650,6 @@ jobs:
       - uses: actions/setup-python@v4
         with:
           python-version: "3.9"
-          token: ${{ env.PAT }}
 
       - uses: actions/setup-node@v3
         with:
@@ -803,7 +784,6 @@ jobs:
         if: always()
         with:
           python-version: "3.9"
-          token: ${{ env.PAT }}
 
       - name: Publish Platform Test Results
         uses: EnricoMi/publish-unit-test-result-action@v2
@@ -879,10 +859,8 @@ jobs:
       - name: Check PAT rate limits
         run: |
           ./tools/bin/find_non_rate_limited_PAT \
-            ${{ secrets.AIRBYTEIO_PAT }} \
-            ${{ secrets.OSS_BUILD_RUNNER_GITHUB_PAT }} \
-            ${{ secrets.SUPERTOPHER_PAT }} \
-            ${{ secrets.DAVINCHIA_PAT }}
+            ${{ secrets.GH_PAT_BUILD_RUNNER_OSS }} \
+            ${{ secrets.GH_PAT_BUILD_RUNNER_BACKUP }}
       - name: Stop EC2 runner
         uses: supertopher/[email protected]
         with:
@@ -911,10 +889,8 @@ jobs:
       - name: Check PAT rate limits
         run: |
           ./tools/bin/find_non_rate_limited_PAT \
-            ${{ secrets.AIRBYTEIO_PAT }} \
-            ${{ secrets.OSS_BUILD_RUNNER_GITHUB_PAT }} \
-            ${{ secrets.SUPERTOPHER_PAT }} \
-            ${{ secrets.DAVINCHIA_PAT }}
+            ${{ secrets.GH_PAT_BUILD_RUNNER_OSS }} \
+            ${{ secrets.GH_PAT_BUILD_RUNNER_BACKUP }}
       - name: Start AWS Runner
         id: start-ec2-runner
         uses: ./.github/actions/start-aws-runner
@@ -949,7 +925,6 @@ jobs:
       - uses: actions/setup-python@v4
         with:
           python-version: "3.9"
-          token: ${{ env.PAT }}
 
       - name: Install unzip
         shell: bash
@@ -1026,7 +1001,6 @@ jobs:
         if: always()
         with:
           python-version: "3.9"
-          token: ${{ env.PAT }}
 
       - name: Publish Kube Test Results
         id: kube-results
@@ -1107,10 +1081,8 @@ jobs:
       - name: Check PAT rate limits
         run: |
           ./tools/bin/find_non_rate_limited_PAT \
-            ${{ secrets.AIRBYTEIO_PAT }} \
-            ${{ secrets.OSS_BUILD_RUNNER_GITHUB_PAT }} \
-            ${{ secrets.SUPERTOPHER_PAT }} \
-            ${{ secrets.DAVINCHIA_PAT }}
+            ${{ secrets.GH_PAT_BUILD_RUNNER_OSS }} \
+            ${{ secrets.GH_PAT_BUILD_RUNNER_BACKUP }}
       - name: Stop EC2 runner
         uses: supertopher/[email protected]
         with:
@@ -1139,10 +1111,8 @@ jobs:
       - name: Check PAT rate limits
         run: |
           ./tools/bin/find_non_rate_limited_PAT \
-            ${{ secrets.AIRBYTEIO_PAT }} \
-            ${{ secrets.OSS_BUILD_RUNNER_GITHUB_PAT }} \
-            ${{ secrets.SUPERTOPHER_PAT }} \
-            ${{ secrets.DAVINCHIA_PAT }}
+            ${{ secrets.GH_PAT_BUILD_RUNNER_OSS }} \
+            ${{ secrets.GH_PAT_BUILD_RUNNER_BACKUP }}
       - name: Start AWS Runner
         id: start-ec2-runner
         uses: ./.github/actions/start-aws-runner
@@ -1197,7 +1167,6 @@ jobs:
       - uses: actions/setup-python@v4
         with:
           python-version: "3.9"
-          token: ${{ env.PAT }}
 
       - uses: actions/setup-java@v1
         with:
@@ -1342,10 +1311,8 @@ jobs:
       - name: Check PAT rate limits
         run: |
           ./tools/bin/find_non_rate_limited_PAT \
-            ${{ secrets.AIRBYTEIO_PAT }} \
-            ${{ secrets.OSS_BUILD_RUNNER_GITHUB_PAT }} \
-            ${{ secrets.SUPERTOPHER_PAT }} \
-            ${{ secrets.DAVINCHIA_PAT }}
+            ${{ secrets.GH_PAT_BUILD_RUNNER_OSS }} \
+            ${{ secrets.GH_PAT_BUILD_RUNNER_BACKUP }}
       - name: Stop EC2 runner
         uses: supertopher/[email protected]
         with:

.github/workflows/label-github-issues-by-context.yml

@@ -8,20 +8,12 @@ jobs:
     name: "Add Labels to Issues.  Safe to Merge on fail"
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout Airbyte Repo for PAT command
-        uses: actions/checkout@v3
-      - name: Check PAT rate limits
-        # Cannot share PAT outside of JOB context
-        run: |
-          ./tools/bin/find_non_rate_limited_PAT \
-            ${{ secrets.OCTAVIA_4_ROOT_ACCESS }} \
-            ${{ secrets.OCTAVIA_PAT }}
       - name: Run Issue Command from workflow-actions
         uses: nick-fields/private-action-loader@v3
         with:
-          pal-repo-token: "${{ env.PAT }}"
+          pal-repo-token: "${{ secrets.GH_PAT_MAINTENANCE_OCTAVIA }}"
           pal-repo-name: airbytehq/workflow-actions@production
           # the following input gets passed to the private
-          token: "${{ env.PAT }}"
+          token: "${{ secrets.GH_PAT_MAINTENANCE_OCTAVIA }}"
           # ref: https://github.com/airbytehq/workflow-actions/blob/main/src/bin_issue.ts
           command: "issue"

.github/workflows/label-github-issues-by-path.yml

@@ -10,16 +10,8 @@ jobs:
     name: "Label PRs based on files changes"
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout Airbyte Repo for PAT command
-        uses: actions/checkout@v2
-      - name: Check PAT rate limits
-        # Cannot share PAT outside of JOB context
-        run: |
-          ./tools/bin/find_non_rate_limited_PAT \
-            ${{ secrets.OCTAVIA_4_ROOT_ACCESS }} \
-            ${{ secrets.OCTAVIA_PAT }}
       - name: "Label PR based on changed files"
         uses: actions/labeler@v3
         with:
-          repo-token: "${{ env.PAT }}"
+          repo-token: "${{ secrets.GH_PAT_MAINTENANCE_OCTAVIA }}"
           sync-labels: true

.github/workflows/label-prs-by-context.yml

@@ -10,19 +10,11 @@ jobs:
     name: "Add Labels to PRs.  Safe to Merge on fail"
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout Airbyte Repo for PAT command
-        uses: actions/checkout@v3
-      - name: Check PAT rate limits
-        # Cannot share PAT outside of JOB context
-        run: |
-          ./tools/bin/find_non_rate_limited_PAT \
-            ${{ secrets.OCTAVIA_4_ROOT_ACCESS }} \
-            ${{ secrets.OCTAVIA_PAT }}
       - name: Run Issue Command from workflow-actions
         uses: nick-fields/private-action-loader@v3
         with:
-          pal-repo-token: "${{ env.PAT }}"
+          pal-repo-token: "${{ GH_PAT_MAINTENANCE_OCTAVIA }}"
           pal-repo-name: airbytehq/workflow-actions@production
           # the following input gets passed to the private action
-          token: "${{ env.PAT }}"
+          token: "${{ GH_PAT_MAINTENANCE_OCTAVIA }}"
           command: "pull"